Browse / Coinbase

Coinbase

See its reports on the map

What gets reported to Coinbase

• Misconfiguration20
• Authentication15
• Information Disclosure11
• Cross-Site Request Forgery7
• Other weaknesses7
• Business Logic5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Double Payout via PayPalBusiness Logic Errors · critical
   $10,000324 votes
2. Ethereum account balance manipulationBusiness Logic Errors · critical
   276 votes
3. ETH contract handling errorsBusiness Logic Errors · critical
   208 votes
4. HTML injection in apps user review Cross-site Scripting (XSS) - Generic
   $20031 votes
5. Authentication IssuePrivilege Escalation · low
   $20027 votes
6. [buy.coinbase.com]Content InjectionViolation of Secure Design Principles · low
   26 votes
7. Captcha Bypass in Coinbase SignUp FormViolation of Secure Design Principles · low
   $10023 votes
8. Bypassing 2FA for BTC transfersImproper Authentication - Generic
   $1,00018 votes
9. Prepopulation of email address and name leaks information provided to other merchantsUI Redressing (Clickjacking)
   16 votes
10. OAuth authorization page vulnerable to clickjackingImproper Authentication - Generic
    16 votes
11. Stored CSS InjectionResource Injection
    15 votes
12. XSSI (Cross Site Script Inclusion)Cross-Site Request Forgery (CSRF)
    15 votes
13. Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response CodeInformation Disclosure
    14 votes
14. Requestor Email Disclosure via Email NotificationInformativeInformation Disclosure · low
    13 votes
15. Stored-XSS in https://www.coinbase.com/Cross-site Scripting (XSS) - Generic
    13 votes
16. Application error messageInformation Disclosure
    $10012 votes
17. Blacklist bypass on Callback URLsInformation Disclosure
    $10012 votes
18. Email leak in transcations in Android appViolation of Secure Design Principles
    $50011 votes
19. Session Issue Maybe Can lead to huge loss [CRITICAL]Cryptographic Issues - Generic
    $1,00010 votes
20. Coinbase Android Security VulnerabilitiesInformativeCryptographic Issues - Generic
    9 votes
21. Race condition allowing user to review app multiple timesBusiness Logic Errors
    8 votes
22. Transactions visible on Unconfirmed devicesImproper Authentication - Generic
    $5008 votes
23. Information disclosure same issue #176002Information Disclosure · low
    $1007 votes
24. Information leakage on https://docs.gdax.comInformation Disclosure
    $1007 votes
25. No authorization required in iOS device web-applicationDuplicateImproper Authentication - Generic
    7 votes
26. ByPassing the email Validation Email on Sign up process in mobile appsViolation of Secure Design Principles
    $1007 votes
27. Leaking CSRF token over HTTP resulting in CSRF protection bypassCross-Site Request Forgery (CSRF)
    $1,0007 votes
28. Information disclosure of user by email using buy widgetInformation Disclosure · medium
    6 votes
29. coinbase Email leak while sending and requestingInformativeImproper Authentication - Generic · low
    6 votes
30. Content Injection error pageInformativeViolation of Secure Design Principles
    6 votes
31. User email enumuration using GmailInformation Disclosure
    6 votes
32. window.opener is leaking to external domains upon redirect on SafariViolation of Secure Design Principles
    5 votes
33. Create Multiple Account Using Similar X-CSRF tokenN/AViolation of Secure Design Principles
    5 votes
34. No authorization required in Windows phone web-applicationDuplicateImproper Authentication - Generic
    5 votes
35. OAUTH pemission set as true= lead to authorize malicious applicationImproper Authentication - Generic
    $1005 votes
36. Two-factor authentication (via SMS)InformativeImproper Authentication - Generic
    5 votes
37. New Device confirmation tokens are not properly validated.Improper Authentication - Generic
    $1005 votes
38. 2FA settings allowed to be changed with no delay/freeze on fundsInformativeViolation of Secure Design Principles
    5 votes
39. An adversary can overwhelm the resources by automating Forgot password/Sign Up requestsN/AImproper Authentication - Generic
    4 votes
40. The 'Create a New Account' action is vulnerable to CSRFN/ACross-Site Request Forgery (CSRF)
    4 votes
41. open authentication bugImproper Authentication - Generic
    4 votes
42. Simultaneous Session Logon : Improper Session ManagementInformativeImproper Authentication - Generic
    4 votes
43. User Enumeration, Information Disclosure and Lack of Rate Limitation on APIInformativeViolation of Secure Design Principles
    4 votes
44. Open redirect on sign in N/AOpen Redirect · low
    3 votes
45. Sending payments via QR code does not require confirmationImproper Authentication - Generic
    $1,0003 votes
46. XXE in OAuth2 Applications gallery profile App logoInformativeXML External Entities (XXE)
    3 votes
47. Sandboxed iframes don't show confirmation screenUI Redressing (Clickjacking)
    3 votes
48. New Device Confirmation, token is valid until not used. Cryptographic Issues - Generic
    3 votes
49. Invoice Details activate JS that filled in Cross-site Scripting (XSS) - Generic
    3 votes
50. CSRF on "Set as primary" option on the accounts pageCross-Site Request Forgery (CSRF)
    $1003 votes
51. Multiple Issues related to registering applicationsViolation of Secure Design Principles
    $1,0003 votes
52. Information Disclosure That shows the webroot of CoinBase ServerInformativeInformation Disclosure
    3 votes
53. Csrf bug on signup sessionInformativeCross-Site Request Forgery (CSRF)
    2 votes
54. Window.opener bug at www.coinbase.com
    $1002 votes
55. User's legal name could be changed despite front end controls being disabledViolation of Secure Design Principles
    2 votes
56. Direct URL access to completed reportsImproper Authentication - Generic
    $2002 votes
57. Balance Manipulation - BUGInformative
    2 votes
58. Credit Card Validation Issue
    2 votes
59. 2 factor authentication design flawViolation of Secure Design Principles
    2 votes
60. IFRAME loaded from External Domains Informative
    2 votes
61. Cookie missing the HttpOnly flag InformativeMisconfiguration
    2 votes
62. Improper Validation of the Referrer header leading to Open URL RedirectionInformativeOpen Redirect
    2 votes
63. User provided values trusted in sensitive actionsInformativeInformation Disclosure
    1 votes
64. User provided values passed to PHP unset() functionInformativeType Confusion
    1 votes
65. New Device Confirmation BugInformative
    1 votes
66. X-Frame-OptionsInformativeUI Redressing (Clickjacking)
    1 votes
67. Information disclosure in coinbase android appInformativeImproper Authentication - Generic · low
    1 votes
68. Transaction Pending Via Ip Change InformativeUncontrolled Resource Consumption
    1 votes
69. Cookie not secureN/AMisconfiguration
    1 votes
70. Inaccurate Payment receipt InformativeBusiness Logic Errors
    1 votes
71. Misconfiguration in 2 factor allows sensitive data exposeInformation Disclosure
    $5001 votes
72. SPF records not foundViolation of Secure Design Principles
    1 votes
73. Runtime manipulation iOS app breaking the PINInformativeViolation of Secure Design Principles
    1 votes
74. Big Bug with Vault which i have already reported: Case #606962
    1 votes
75. iframes considered harmfulInformativeViolation of Secure Design Principles
    1 votes
76. CSRF in function "Set as primary" on accounts pageCross-Site Request Forgery (CSRF)
    1 votes
77. Device confirmation FlawInformative
78. CSRF bug on password changeN/ACross-Site Request Forgery (CSRF)
79. Information disclosue in Android ApplicationDuplicateUncontrolled Resource Consumption · low
80. Potential for Double Spend via Sign Message UtilityInformativeCryptographic Issues - Generic